[Change] changelog: dedup v2.0.2 entries per /r-util-chg-dedup

[Change] changelog: reorder v2.0.2 sections to v2.0.1 convention
         (New Features / Changes / Bug Fixes); rename "Fixes" to
         "Bug Fixes" for section-name parity
[Change] changelog: fold hookscan validation-reorder [Change] into the
         hookscan audit-trail [New] entry — the reorder is implementation
         detail of the feature, not a standalone change
[Change] changelog: fold alert_lib 1.0.7 -> 1.0.8 [Change] into the
         telegram [Fix] entry — the lib bump IS the fix delivery mechanism
[Change] changelog: drop 33-file header-sweep [Change] — copyright/banner
         housekeeping, not user-facing

Author: rfxn

CHANGELOG

@@ -1,42 +1,37 @@
 v2.0.2 | May 12 2026:
 
-  -- Fixes --
-
-[Fix] quarantine: symlink TOCTOU guards across scan-to-quarantine
-      (_batch_quarantine pre-filter + per-file, _quarantine_file, quar_hitlist
-      callers), restore (_validate_restore_path), and clean-failure
-      re-quarantine (clean); SECURITY-FINDINGS P2-1 + P3-6 deferred from 2.0.1
-[Fix] alert: telegram delivery failed on MarkdownV2 reserved characters in
-      substituted token values; wired escape_mode in _alert_tpl_render
-      (alert_lib 1.0.8) and mirrored in _lmd_render_entries; affects
-      --test-alert {scan,digest} telegram and real telegram alerts; issue #487
-
   -- New Features --
 
 [New] hookscan: audit-trail coverage for pre-scan validation decisions —
       filename rejection (non_printable, metachar, traversal, relative_path),
       homedir-restriction violation, scan timeout, and scan error now emit
       pattern_matched/error_occurred/hook_timeout/hook_failed events to
-      audit.log with mode= and reason= extras; closes G-04 (single-file
-      path) from docs/specs/2026-03-24-audit-log-coverage-assessment.md
+      audit.log with mode= and reason= extras (filename validation reordered
+      to run after elog_lib sourcing so rejection events reach audit.log);
+      closes G-04 single-file path from
+      docs/specs/2026-03-24-audit-log-coverage-assessment.md
 [New] hookscan: BATS coverage for ftp mode (pure-ftpd CallUploadScript)
       including UPLOAD_VUSER env-var auto-detect and explicit-ftp-overrides;
       ftp mode is logger-only on stdout (fire-and-forget per pure-uploadscript
       contract); docs/specs/2026-03-23-hookscan-improvement-proposal.md §3b
 
   -- Changes --
 
-[Change] hookscan: filename validation block reordered to run after
-         elog_lib sourcing so rejection events reach audit.log; rejection
-         path semantics unchanged (still bails before any scan work)
 [Change] release: version bump 2.0.1 -> 2.0.2
-[Change] headers: sweep 33 source files (sub-libs, hookscan.sh, uninstall.sh,
-         cron.daily, service files, clean scripts) to v2.0.2 banner — parent
-         CLAUDE.md "All version/copyright headers must stay in sync"
 [Change] ignore_inotify.defaults: add Dovecot doveconf tempfiles
          (/tmp/doveconf., /var/tmp/doveconf.) — Plesk mail subsystem; issue #488
-[Change] alert_lib: vendored 1.0.7 -> 1.0.8 (escape_mode + skip_tokens in
-         _alert_tpl_render)
+
+  -- Bug Fixes --
+
+[Fix] quarantine: symlink TOCTOU guards across scan-to-quarantine
+      (_batch_quarantine pre-filter + per-file, _quarantine_file, quar_hitlist
+      callers), restore (_validate_restore_path), and clean-failure
+      re-quarantine (clean); SECURITY-FINDINGS P2-1 + P3-6 deferred from 2.0.1
+[Fix] alert: telegram delivery failed on MarkdownV2 reserved characters in
+      substituted token values; wired escape_mode + skip_tokens in
+      _alert_tpl_render (vendored alert_lib 1.0.7 -> 1.0.8) and mirrored in
+      _lmd_render_entries; affects --test-alert {scan,digest} telegram and
+      real telegram alerts; issue #487
 
 v2.0.1 | Mar 25 2026:
 

CHANGELOG.RELEASE

@@ -1,16 +1,5 @@
 v2.0.2 | May 12 2026:
 
-  -- Fixes --
-
-[Fix] quarantine: symlink TOCTOU guards across scan-to-quarantine
-      (_batch_quarantine pre-filter + per-file, _quarantine_file, quar_hitlist
-      callers), restore (_validate_restore_path), and clean-failure
-      re-quarantine (clean); SECURITY-FINDINGS P2-1 + P3-6 deferred from 2.0.1
-[Fix] alert: telegram delivery failed on MarkdownV2 reserved characters in
-      substituted token values; wired escape_mode in _alert_tpl_render
-      (alert_lib 1.0.8) and mirrored in _lmd_render_entries; affects
-      --test-alert {scan,digest} telegram and real telegram alerts; issue #487
-
   -- New Features --
 
 [New] hookscan: audit-trail coverage for pre-scan validation rejections
@@ -21,14 +10,21 @@ v2.0.2 | May 12 2026:
 
   -- Changes --
 
-[Change] hookscan: validation reordered to run after elog_lib source so
-         rejection events reach audit.log
 [Change] release: version bump 2.0.1 -> 2.0.2
-[Change] headers: sweep 33 source files to v2.0.2 banner — header sync hygiene
 [Change] ignore_inotify.defaults: add Dovecot doveconf tempfiles
          (/tmp/doveconf., /var/tmp/doveconf.) — Plesk mail subsystem; issue #488
-[Change] alert_lib: vendored 1.0.7 -> 1.0.8 (escape_mode + skip_tokens in
-         _alert_tpl_render)
+
+  -- Bug Fixes --
+
+[Fix] quarantine: symlink TOCTOU guards across scan-to-quarantine
+      (_batch_quarantine pre-filter + per-file, _quarantine_file, quar_hitlist
+      callers), restore (_validate_restore_path), and clean-failure
+      re-quarantine (clean); SECURITY-FINDINGS P2-1 + P3-6 deferred from 2.0.1
+[Fix] alert: telegram delivery failed on MarkdownV2 reserved characters in
+      substituted token values; wired escape_mode in _alert_tpl_render
+      (vendored alert_lib 1.0.7 -> 1.0.8) and mirrored in _lmd_render_entries;
+      affects --test-alert {scan,digest} telegram and real telegram alerts;
+      issue #487
 
 v2.0.1 | Mar 25 2026: